Debian's arm64 UEFI Secure Boot shim makes the EFI variable store run
out of space while mirroring its MOK database to variables. This can be
observed in QEMU like so:
$ tools/buildman/buildman -o build/qemu_arm64 --boards=qemu_arm64 -w
$ cd build/qemu_arm64
$ curl -L -o debian.iso \
https://cdimage.debian.org/debian-cd/current/arm64/iso-cd/debian-12.0.0-arm64-netinst.iso
$ qemu-system-aarch64 \
-nographic -bios u-boot.bin \
-machine virt -cpu cortex-a53 -m 1G -smp 2 \
-drive if=virtio,file=debian.iso,index=0,format=raw,readonly=on,media=cdrom
[...]
=> # interrupt autoboot
=> env set -e -bs -nv -rt -guid 605dab50-e046-4300-abb6-3dd810dd8b23 SHIM_VERBOSE 1
=> boot
[...]
mok.c:296:mirror_one_esl() SetVariable("MokListXRT43", ... varsz=0x4C) = Out of Resources
mok.c:452:mirror_mok_db() esd:0x7DB92D20 adj:0x30
Failed to set MokListXRT: Out of Resources
mok.c:767:mirror_one_mok_variable() mirror_mok_db("MokListXRT", datasz=17328) returned Out of Resources
mok.c:812:mirror_one_mok_variable() returning Out of Resources
Could not create MokListXRT: Out of Resources
[...]
Welcome to GRUB!
This would normally be fine as shim would continue to run grubaa64.efi,
but shim's error handling code for this case has a bug [1] that causes a
synchronous abort on at least chromebook_kevin (but apparently not on
QEMU arm64).
Double the default variable store size so the variables fit. There is a
note about this value matching PcdFlashNvStorageVariableSize when
EFI_MM_COMM_TEE is enabled, so keep the old default in that case.
[1] https://github.com/rhboot/shim/pull/577
Signed-off-by: Alper Nebi Yasak <alpernebiyasak@gmail.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
The efi_var_mem_free() function calculates the available size for a new
EFI variable by subtracting the occupied buffer size and the overhead
for a new variable from the maximum buffer size set in Kconfig. This
is then returned as QueryVariableInfo()'s RemainingVariableStorageSize
output.
This can underflow as the calculation is done in and processed as
unsigned integer types. Check for underflow before doing the subtraction
and return zero if there's no space.
Fixes: f1f990a8c9 ("efi_loader: memory buffer for variables")
Signed-off-by: Alper Nebi Yasak <alpernebiyasak@gmail.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Instead of discovering the ID of the device and call two different
functions for a block device or a partition, we can rewrite
efi_disk_remove() and handle the minor differences between the two
variants internally. As a results we can simplify efi_disk_remove()
a lot and get rid of the extra efi_disk_delete_raw/blk calls.
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
If a handle is not found, return 0 to let the device be removed.
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
The FMP Payload Header which EDK II capsule generation scripts
insert has a firmware version.
This commit reads the lowest supported version stored in the
device tree, then check if the firmware version in FMP payload header
of the ongoing capsule is equal or greater than the
lowest supported version. If the firmware version is lower than
lowest supported version, capsule update will not be performed.
Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
This commit gets the lowest supported version from device tree,
then fills the lowest supported version in FMP->GetImageInfo().
Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Current FMP->GetImageInfo() always return 0 for the firmware
version, user can not identify which firmware version is currently
running through the EFI interface.
This commit reads the "FmpStateXXXX" EFI variable, then fills the
firmware version in FMP->GetImageInfo().
Now FMP->GetImageInfo() and ESRT have the meaningful version number.
Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Firmware version management is not implemented in the current
FMP protocol.
EDK II reference implementation capsule generation script inserts
the FMP Payload Header right before the payload, FMP Payload Header
contains the firmware version and lowest supported version.
This commit utilizes the FMP Payload Header, reads the header and
stores the firmware version into "FmpStateXXXX" EFI non-volatile variable.
XXXX indicates the image index, since FMP protocol handles multiple
image indexes.
Note that lowest supported version included in the FMP Payload Header
is not used. If the platform uses file-based EFI variable storage,
it can be tampered. The file-based EFI variable storage is not the
right place to store the lowest supported version for anti-rollback
protection.
This change is compatible with the existing FMP implementation.
This change does not mandate the FMP Payload Header.
If no FMP Payload Header is found in the capsule file, fw_version,
lowest supported version, last attempt version and last attempt
status is 0 and this is the same behavior as existing FMP
implementation.
Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
The number of image array entries global variable is required
to support EFI capsule update. This information is exposed as a
num_image_type_guids variable, but this information
should be included in the efi_capsule_update_info structure.
This commit adds the num_images member in the
efi_capsule_update_info structure. All board files supporting
EFI capsule update are updated.
Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
part_get_info() may return an error code. Check it.
Update function description of dp_part_node().
Addresses-Coverity-ID: 184067 ("Unchecked return value")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
These files should have both 'always' and 'targets' so that dependencies
are detected correctly.
When only 'always' is used, the target is built every time, although I am
not quite sure why.
Make sure each has both 'always' and 'targets' to avoid this problem.
Signed-off-by: Simon Glass <sjg@chromium.org>
* When called from efi_dp_from_name() we miss to append the filename
for non-block devices.
* expand_media_path() could be simplified by using efi_dp_from_file to
prepend the device path of the boot device.
This can be avoided by passing a device path to efi_dp_from_file() instead
of a block device descriptor and a partition number.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
* Improve variable name usage: Use pos instead of buf to indicate the
current position in a buffer.
* Avoid double assignment in a single code line.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
efi_dp_from_name() has duplicate code to replace slash by backslash.
path_to_uefi() called by efi_dp_from_file() already does this.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
According to our coding style guide #ifdef should be avoided.
Use IS_ENABLED() instead.
Sort string comparisons alphabetically.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Executing an EFI binary fails for files loaded via semihosting.
Construct a dummy device path for EFI binaries loaded via semihosting.
A future complete solution may include the creation of a handle with a
simple file system protocol.
Reported-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
HandleProtocol() is deprecated and leaves an OpenedProtocolInformation
behind. Use OpenProtocol(GET_PROTOCOL) instead.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
HandleProtocol() is deprecated and leaves an OpenedProtocolInformation
behind. Use OpenProtocol(GET_PROTOCOL) instead.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Create a distinct EFI device path for each blkmap device.
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Assigning the value of a variable to itself should be avoided.
Addresses-Coverity-ID: 451089 ("Evaluation order violation")
Fixes: 180b7118be ("efi_loader: fix device-path for USB devices")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
We use short device-paths in boot options so that a file on a block device
can be found independent of the port into which the device is plugged.
Usb() device-path nodes only contain port and interface information and
therefore cannot identify a block device.
UsbWwi() device-path nodes contain the serial number of USB devices.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
The incumbent function efi_alloc() is unused.
Replace dp_alloc() by a new function efi_alloc() that we can use more
widely.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
EFI device paths for block devices must be unique. If a non-unique device
path is discovered, probing of the block device fails.
Currently we use UsbClass() device path nodes. As multiple devices may
have the same vendor and product id these are non-unique. Instead we
should use Usb() device path nodes. They include the USB port on the
parent hub. Hence they are unique.
A USB storage device may contain multiple logical units. These can be
modeled as Ctrl() nodes.
Reported-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
* Add the definitions for Ctrl() device path nodes.
* Implement Ctrl() nodes in the device path to text protocol.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
EFI device paths for block devices must be unique. If a non-unique device
path is discovered, probing of the block device fails.
Currently we use UsbClass() device path nodes. As multiple devices may
have the same vendor and product id these are non-unique. Instead we
should use Usb() device path nodes. They include the USB port on the
parent hub. Hence they are unique.
A USB storage device may contain multiple logical units. These can be
modeled as Ctrl() nodes.
Reported-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
* Add the definitions for Ctrl() device path nodes.
* Implement Ctrl() nodes in the device path to text protocol.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Add a function description.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
UEFI specification v2.10 says that
EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS is deprecated and
EFI_UNSUPPORTED should be returned in SetVariable variable service.
Current implementation returns EFI_INVALID_PARAMETER,
let's fix the return value.
Together with above change, this commit also updates the SetVariable
attribute check to be aligned with the EDK2 reference implementation.
Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
A previous commit is adding a new tpm startup functions which
initializes the TPMv2 and performs all the needed selftests.
Since the TPM selftests might be needed depending on the requested
algorithm or functional module use that instead.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Adds CONFIG_EFI_CAPSULE_MAX to configure the max index value used in
EFI capsule reports. Prior to this change is the hard coded value was
65535 which would exceed available storage for variables. Now the
default value is 15 which should work fine with most systems.
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Measures the DTB passed to the EFI application upon new boolean config
switch CONFIG_EFI_TCG2_PROTOCOL_MEASURE_DTB. For platforms where the
content of the DTB passed to the OS can change across reboots, there is
not point measuring it hence the config switch to allow platform to not
embed this feature.
Co-developed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
QueryVariableInfo with EFI_VARIABLE_HARDWARE_ERROR_RECORD is
accepted, remove wrong attribute check.
Fixes: 454a9442fb ("efi_loader: update attribute check for QueryVariableInfo()")
Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Documentation:
* Provide page with links to talks on U-Boot
UEFI:
* Enable CTRL+S to save the boot order in eficonfig command
* Run attribute check for QueryVariableInfo() only for the file store
* Bug fixes
Others:
* Improve output formatting of the coninfo command
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEbcT5xx8ppvoGt20zxIHbvCwFGsQFAmPme8EACgkQxIHbvCwF
GsTJ6RAAiDVG2OFTodxLFVhzxoorrIf/piMZDxtc1ClRxF7CPe5CET18bHp0hvvw
qKJW+dk3aCUSr+E1Ma9ndAHI+/mKmEXudZj/XuUyxlVhm9P8Fw2EQRGZFeogdp0v
/tMB8c7DjW5kTg39/U3z3F7qo6ifs1I8rGcxAhvU38iuOmmIai6AZH1cEq2P2zY9
JdHPzSCVz4TOGzmhJD3wxYMn+DjsLxIT0tggGPRJzXGaAdZdLS7cl/X52rabV/Tq
aJXhjpWNl7RUiNiQbKMtltbmkJQ2MpHkhLGDj2/3H2W5sbpIx0GwDs7r0GSKJ0Ba
6ycn5NBjP3C3gcl91oWJXrzux6LN2aWqe45lgOLpL2H2pPaRlDebBEdDA+oNQKoo
mqX8pMbLfpb3nhg/fOXo/YDZ5Uug42fmpjj3Vu5+imjq9jL+tr5lxZ2oDpsUyT51
MvQXohYTfsYNHQm7M4BzGIuA66WwCJ5TJ3D/YmwdDWPnCCN+QAUMI2/d8Osbct6W
OBGaoZQoRpPZV62+mrHloXW9j8sapcQfJGejdby7S1bxagF/KG/BLXGCWH/HdWCc
TsnW+bOOF4N9gIyyyu3yRfHyE7pIyszWlNwRAuPzjwG0dxEbkboA/JdLIFic3Qsj
fk/65FSvvAeOuvNYEgsEA5VYXJzhD4oNtcNQZHIHjhSTGKBrJF4=
=HVHT
-----END PGP SIGNATURE-----
Merge tag 'efi-2023-04-rc2' of https://source.denx.de/u-boot/custodians/u-boot-efi
Pull request for efi-2023-04-rc2
Documentation:
* Provide page with links to talks on U-Boot
UEFI:
* Enable CTRL+S to save the boot order in eficonfig command
* Run attribute check for QueryVariableInfo() only for the file store
* Bug fixes
Others:
* Improve output formatting of the coninfo command
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 10 Feb 2023 12:15:45 PM EST
# gpg: using RSA key 6DC4F9C71F29A6FA06B76D33C481DBBC2C051AC4
# gpg: Good signature from "Heinrich Schuchardt <xypron.glpk@gmx.de>" [unknown]
# gpg: aka "[jpeg image of size 1389]" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6DC4 F9C7 1F29 A6FA 06B7 6D33 C481 DBBC 2C05 1AC4
